Skip to content

fix(ui): exclude vector_store_ids from model edit JSON textarea - #27597

Closed
Jwrede wants to merge 1 commit into
BerriAI:litellm_internal_stagingfrom
Jwrede:fix/model-edit-vector-store-ids-leak
Closed

fix(ui): exclude vector_store_ids from model edit JSON textarea#27597
Jwrede wants to merge 1 commit into
BerriAI:litellm_internal_stagingfrom
Jwrede:fix/model-edit-vector-store-ids-leak

Conversation

@Jwrede

@Jwrede Jwrede commented May 10, 2026

Copy link
Copy Markdown

Summary

  • Exclude vector_store_ids, guardrails, and tags from the litellm_extra_params JSON textarea in the model edit form, matching the existing litellm_credential_name exclusion
  • Also delete these keys from the parsed JSON on submit, so manually injecting them into the textarea cannot override the dedicated form fields

These fields all have dedicated form inputs that handle their own submission logic. Including them in the catch-all JSON textarea creates a duplication path where the JSON values can override the form field logic, silently injecting parameters like vector_store_ids: [] into litellm_params for non-OpenAI models.

Fixes #27117

Test plan

  • Existing test should not include vector_store_ids in update payload when model has none passes
  • New test should not leak vector_store_ids from JSON textarea when model already has them -- verifies the JSON textarea does not contain vector_store_ids even when the model has them
  • Full model_info_view test suite passes (36/36)

Fields with dedicated form inputs (vector_store_ids, guardrails, tags)
were included in the litellm_extra_params JSON textarea. On save, these
duplicated values from the JSON could override the dedicated form field
logic, injecting unwanted parameters into litellm_params for non-OpenAI
models.

Exclude these fields from the JSON textarea (matching the existing
litellm_credential_name exclusion) and delete them from parsed JSON on
submit.

Fixes BerriAI#27117
@greptile-apps

greptile-apps Bot commented May 10, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR fixes a duplication bug in the model edit form where vector_store_ids, guardrails, and tags were leaking into the catch-all JSON textarea, allowing textarea values to silently override the dedicated form fields for those inputs on save.

  • Textarea exclusion (model_info_view.tsx line 657): The three fields are now filtered out when building the textarea's initial JSON value, matching the pre-existing litellm_credential_name exclusion.
  • Submit-time stripping (model_info_view.tsx lines 238–240): Even if a user manually injects these keys into the textarea, they are deleted from parsedExtraParams before it is merged into updatedLitellmParams, so the dedicated form-field logic at lines 274–283 always wins.
  • New test (model_info_view.test.tsx): Verifies the textarea does not contain vector_store_ids when the model already has them; no existing tests are altered.

Confidence Score: 5/5

Safe to merge — the change is narrowly scoped to excluding three fields from a JSON textarea, with the fix covered by a new test and no existing tests modified.

The fix is minimal and additive: it extends an already-proven pattern (litellm_credential_name exclusion) to three additional fields, each of which has its own dedicated form handler that correctly owns the submit logic. The textarea-strip on submit provides defence-in-depth against manual injection. A new test directly validates the regression path, and the existing 36-test suite continues to pass.

No files require special attention.

Important Files Changed

Filename Overview
ui/litellm-dashboard/src/components/model_info_view.tsx Excludes vector_store_ids, guardrails, and tags from the JSON textarea initial value and strips them on submit — mirrors existing litellm_credential_name exclusion. Dedicated form-field handlers at lines 274–283 remain the authoritative source for those values.
ui/litellm-dashboard/src/components/model_info_view.test.tsx Adds a new test verifying that vector_store_ids does not appear in the JSON textarea even when the model already has them; no existing tests are modified or weakened.

Reviews (2): Last reviewed commit: "fix(ui): exclude vector_store_ids from m..." | Re-trigger Greptile

@Jwrede

Jwrede commented May 10, 2026

Copy link
Copy Markdown
Author

@greptileai review

@codecov

codecov Bot commented May 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

@github-actions github-actions Bot added the stale label Aug 9, 2026
@github-actions github-actions Bot closed this Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: vector_store_ids Automatically Injected When Editing a Model via UI, Breaking Gemini Embedding Models

2 participants